Host computer intrude detecting method decomposed based on inherent subsequence mode

Abstract

The invention discloses a host computer invasion detection method based on the natural subsequence mode decomposition. The method includes the following steps: (1) defining rules; (2) obtaining Windows Native API data sequence, decomposing process sequences into natural subsequence mode sets and then layering the natural subsequence modes according to the support degree; (3) decomposing suspected sequences into a plurality of layers respectively containing natural sequence modes with similar support degrees; (4) matching the normal process sequences with the suspected sequences according to the corresponding layers, calculating the abnormal degree according to the matched number and judging if the suspected sequences are abnormal. The method overcomes the disadvantages existed in the prior art and can accurately and effectively identify the current attacks and the new increasing attacks.

Description

technical field [0001] The invention relates to the technical field of computer security, in particular to a host intrusion detection method. Background technique [0002] The development of computer networking technology has changed the computing model dominated by stand-alone computers. However, the risks and opportunities of network intrusion have correspondingly increased dramatically. Designing security measures to prevent unauthorized access to system resources and data is a very important and urgent problem in the field of network security. Intrusion detection is a kind of network security technology produced and developed under this background. Specifically, intrusion detection is to monitor the operating status of the network system, detect and discover various attack attempts, attack behaviors or attack results, so as to ensure the confidentiality, integrity and availability of system resources. Intrusion detection technology is mainly divided into two categorie...

AI Technical Summary

Problems solved by technology

[0052] This method has a large amount of calculation, the establishment of first-order and second-order models, the calculation of parameters, and the process of training and building models for normal data are very complicated, and it is difficult to apply them in practice.

And this method only considers the relationship between the two steps before and after the process to call the Native API, but the Native API call process in the actual situation is very complicated, and only considering the two steps before and after the relationship model is not enough to describe the complex call process of the process to the Native API in the actual operating environment

Therefore, this method is only applicable to the detection of certain intrusions, and cannot be generally applied to intrusion detection in real-time environments.

Images